This tutorial will show you how to integrate Spring Security into a Spring MVC application using purely Java configuration. The application won’t use a database, the user credentials are just defined as plain text in the configuration class for simplicity.

We will show you almost all of the files needed for the working application, but will only describe the parts that are strictly connected to the Spring Security integration and not just there to have a basic webapp up and running.

At the end of the tutorial you can download the whole working Maven project.

spring-security-web: Contains filters and related web-security infrastructure code. You’ll need it if you require Spring Security web authentication services and URL-based access-control. This also pulls in the spring-security-core dependency.

spring-security-config: Contains the security namespace parsing code. You need it if you are using the Spring Security XML namespace for configuration.

We also needed to set the failOnMissingWebXml property to false, because by default STS would report an error that we don’t have a web.xml.

The springSecurityFilterChain filter

One of the core elements of Spring Security is a chain of filters that determine if the user has access to a given resource. If we are using Java configuration, setting this up is really easy, we just have to create a class extending the AbstractSecurityWebApplicationInitializer class.

This tutorial will show you how to integrate Spring Security into a Spring MVC application. The application won’t use a database, the user credentials are just defined as plain text in the configuration file for simplicity.

We will show you almost all of the files needed for the working application, but will only describe the parts that are strictly connected to the Spring Security integration and not just there to have a basic webapp up and running.

At the end of the tutorial you can download the whole working Maven project.

Tools used:

Spring Tool Suite 3.7.1.RELEASE

Apache Maven 3.3.9

Java 8

Tomcat 8.0.32

The project structure

Here you can see the structure of the finished project.

Dependencies

Aside from Spring that we are using to build our webapp, we need two Spring Security related dependencies.

In the http element, we define the rules and settings for our security purposes:

The use-expressions="true" attribute means that we can provide the access rules as expressions (like permitAll), instead of the traditional set of attributes.

Each intercept-url element describes one rule for our security. The first rule means that we should allow everyone to access the login page, the second rule means that all other pages are protected and need the ROLE_USER role to have access.

In the form-login element we specify some URLs to use for the login form.

default-target-url: After successful login, the user will be redirected here.

login-page: The URL of the login page.

authentication-failure-url: The URL to redirect to when authentication fails.

In the logout element we specify the URL to redirect to when the logout is successful.

In the authentication-manager element in this simple example we define the valid user credentials as plain text. There are alternative configurations available for cases when for example you would like to get user details from a database.

The XML is imported in the main application context (application-context.xml):

The URL where we post the form (/login) is the default URL in Spring Security 4.

The names of the fields (username, password) are also the default names expected by Spring Security.

The hidden field is there because CSRF protection is enabled by default and we need a token to be able to submit the form.

Warning: In earlier versions of Spring Security the defaults mentioned could be different, so please pay attention to that if you are on an older version.

Other files

Other then the code I showed you, we have a very simple view file for the home page. And also two very simple controllers for the home and login. Also we have a dispatcher-servlet.xml where we configure the view resolver and the some other things.

Result

When you run the project, you get a simple login form and when you log in with the right credentials it redirects you the the home page.